Data Protection Rule

Approved and Implemented: February 22, 2017

Reviewed/Updated: June 28, 2021

1.0 Introduction

The objective of this standard for research data security requirements is to assist the UAB research community in the protections requirements of data and systems.

2.0 Scope and Applicability

All UAB research data stored, processed, or transmitted must be protected in accordance with these standards. Based on the regulatory or contractual requirements of the award; researchers are required to implement appropriate security controls.

Researchers are encouraged to consult with their department IT support, as needed. Many of the protections described herein are provided with UABIT-supported servers and networks, and would not require any additional technical investments by the researchers.

3.0 Classification of Research Data

The classification of research data depends on several factors such as type of data, and/or contractual elements and thus may fall into any of the classifications defined herein. Likewise, time of release and collaboration effect the classification of research data. As such, certain unpublished research data may be classified as private or sensitive until such time the research is published.

Likewise, intellectual property that has not been disclosed to or protected by the IIE may need to be classified as sensitive. Additionally, federal laws, rules and regulations (including but not limited to FISMA, HIPAA, FERPA, and Export Controls), sponsor requirements, and UAB policies and guidelines will necessitate a certain classification.

It is incumbent upon the Researcher to know the type of data, the circumstances governing the data, and classify it accordingly. Once classified, the Researcher will need to maintain the data using the appropriate UAB system of record or database with the appropriate access and security controls aligning to the classification standard. For example, not all UAB data storage options are recommended for sensitive data.

Research data shall also be maintained in accordance with UAB’s Record Retention Policy and record retention schedule. For more information about protected research data please refer to the UAB OVPRED.

3.1 Specific Roles and Responsibilities for Protecting Institutional Data

3.2 Data Stewards have administrative control and are officially accountable for a specific information asset.

Data Stewards shall:

• assign an appropriate classification to the information;

• govern processes for determining access to information assets; and

• ensure compliance with policies and regulatory requirements related to the information.

Examples: VP of Financial Affairs & Administration - financial and HR data; VP of Research & Economic Development - research administration data; Deans and Unit Chairs and data from their respective academic area.

3.3 Data Custodians safeguard the data on behalf of the Data Steward.

• UAB’s central Information Technology (IT) units shall be responsible for protecting all Institutional Data maintained/stored in the institutional information systems.

• Distributed Information Technology (IT) units shall be responsible for protecting all Institutional Data maintained/stored in unit level information systems.

3.4 UAB Information Security

Members of the UAB Information Security team are responsible for developing and implementing an information security program as well as the supporting data security and protection policies, standards and procedures.

3.5 Information Security Liaison (ISL)

Each unit senior manager will designate at least one ISL who will act as a liaison to the UAB information Security Team. ISLs oversee information security responsibilities for the units and schools, including assisting with security awareness and security incident response.

3.6 System Administrators

System Administrators are individuals within the central IT/HSIS or school/units with day-to-day responsibility for maintaining information systems.

3.7 Data Users

Data Users are individuals authorized to access UAB data and are responsible for protecting the information assets on a daily basis through adherence to UAB policies.

4.0 Protection Requirements Based on Classification

The table below defines minimum protection requirements for each category of data when being used or handled in a specific context (e.g. Sensitive Data sent in an email message). Please note that these protections are not intended to supersede any regulatory or contractual requirements for handling data.